CVE-2020-29444: 
Confluence Server vulnerability analysis and mitigation

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting (XSS) vulnerability in admin global setting parameters. The vulnerability was discovered by Stefano Castilletti, a security researcher from Apple, and was assigned CVE-2020-29444 (JIRA, NVD).

The vulnerability is classified as a Cross Site Scripting (XSS) vulnerability that specifically affects the admin global setting parameters in Team Calendar. It has been assigned a CVSS v3.1 score of 5.4 (Medium severity), indicating a moderate level of risk. The vulnerability affects Confluence Server versions before 7.11.0, including versions 7.4.4 and 7.9.0 (JIRA).

The vulnerability allows attackers to inject and execute arbitrary HTML or JavaScript code in the context of the admin global setting parameters. This could potentially lead to unauthorized access to sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (NVD).

The vulnerability has been fixed in Confluence version 7.11.0. Users are advised to upgrade to this version or later to mitigate the risk. Additionally, Team Calendar specific fixes were released in versions TC-6.1.8 and TC-7.0.7 (JIRA).